{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2022-50841 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50841 is a high-severity vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2022-50841 and fix it if it is affected.\n\nWhat it is: CVE-2022-50841 is a high-severity vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2022-50841 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50841/ (Markdown: https://insights.sbomify.com/CVE-2022-50841/index.md)","id":"CVE-2022-50841","markdown":"https://insights.sbomify.com/CVE-2022-50841/index.md","name":"CVE-2022-50841","record":{"aliases":["DEBIAN-CVE-2022-50841","GHSA-c5pm-qhvm-f5v5","UBUNTU-CVE-2022-50841"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel NTFS3","requires_auth":"none","summary":"An integer overflow in the Linux kernel NTFS3 driver allows out-of-bounds memory access, potentially leading to code execution or system crashes.","user_interaction":"required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add overflow check for attribute size\n\nThe offset addition could overflow and pass the used size check given an\nattribute with very large size (e.g., 0xffffff7f) while parsing MFT\nattributes. This could lead to out-of-bound memory R/W if we try to\naccess the next attribute derived by Add2Ptr(attr, asize)\n\n[   32.963847] BUG: unable to handle page fault for address: ffff956a83c76067\n[   32.964301] #PF: supervisor read access in kernel mode\n[   32.964526] #PF: error_code(0x0000) - not-present page\n[   32.964893] PGD 4dc01067 P4D 4dc01067 PUD 0\n[   32.965316] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[   32.965727] CPU: 0 PID: 243 Comm: mount Not tainted 5.19.0+ #6\n[   32.966050] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[   32.966628] RIP: 0010:mi_enum_attr+0x44/0x110\n[   32.967239] Code: 89 f0 48 29 c8 48 89 c1 39 c7 0f 86 94 00 00 00 8b 56 04 83 fa 17 0f 86 88 00 00 00 89 d0 01 ca 48 01 f0 8d 4a 08 39 f9a\n[   32.968101] RSP: 0018:ffffba15c06a7c38 EFLAGS: 00000283\n[   32.968364] RAX: ffff956a83c76067 RBX: ffff956983c76050 RCX: 000000000000006f\n[   32.968651] RDX: 0000000000000067 RSI: ffff956983c760e8 RDI: 00000000000001c8\n[   32.968963] RBP: ffffba15c06a7c38 R08: 0000000000000064 R09: 00000000ffffff7f\n[   32.969249] R10: 0000000000000007 R11: ffff956983c760e8 R12: ffff95698225e000\n[   32.969870] R13: 0000000000000000 R14: ffffba15c06a7cd8 R15: ffff95698225e170\n[   32.970655] FS:  00007fdab8189e40(0000) GS:ffff9569fdc00000(0000) knlGS:0000000000000000\n[   32.971098] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   32.971378] CR2: ffff956a83c76067 CR3: 0000000002c58000 CR4: 00000000000006f0\n[   32.972098] Call Trace:\n[   32.972842]  \u003cTASK\u003e\n[   32.973341]  ni_enum_attr_ex+0xda/0xf0\n[   32.974087]  ntfs_iget5+0x1db/0xde0\n[   32.974386]  ? slab_post_alloc_hook+0x53/0x270\n[   32.974778]  ? ntfs_fill_super+0x4c7/0x12a0\n[   32.975115]  ntfs_fill_super+0x5d6/0x12a0\n[   32.975336]  get_tree_bdev+0x175/0x270\n[   32.975709]  ? put_ntfs+0x150/0x150\n[   32.975956]  ntfs_fs_get_tree+0x15/0x20\n[   32.976191]  vfs_get_tree+0x2a/0xc0\n[   32.976374]  ? capable+0x19/0x20\n[   32.976572]  path_mount+0x484/0xaa0\n[   32.977025]  ? putname+0x57/0x70\n[   32.977380]  do_mount+0x80/0xa0\n[   32.977555]  __x64_sys_mount+0x8b/0xe0\n[   32.978105]  do_syscall_64+0x3b/0x90\n[   32.978830]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   32.979311] RIP: 0033:0x7fdab72e948a\n[   32.980015] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[   32.981251] RSP: 002b:00007ffd15b87588 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5\n[   32.981832] RAX: ffffffffffffffda RBX: 0000557de0aaf060 RCX: 00007fdab72e948a\n[   32.982234] RDX: 0000557de0aaf260 RSI: 0000557de0aaf2e0 RDI: 0000557de0ab7ce0\n[   32.982714] RBP: 0000000000000000 R08: 0000557de0aaf280 R09: 0000000000000020\n[   32.983046] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000557de0ab7ce0\n[   32.983494] R13: 0000557de0aaf260 R14: 0000000000000000 R15: 00000000ffffffff\n[   32.984094]  \u003c/TASK\u003e\n[   32.984352] Modules linked in:\n[   32.984753] CR2: ffff956a83c76067\n[   32.985911] ---[ end trace 0000000000000000 ]---\n[   32.986555] RIP: 0010:mi_enum_attr+0x44/0x110\n[   32.987217] Code: 89 f0 48 29 c8 48 89 c1 39 c7 0f 86 94 00 00 00 8b 56 04 83 fa 17 0f 86 88 00 00 00 89 d0 01 ca 48 01 f0 8d 4a 08 39 f9a\n[   32.988232] RSP: 0018:ffffba15c06a7c38 EFLAGS: 00000283\n[   32.988532] RAX: ffff956a83c76067 RBX: ffff956983c76050 RCX: 000000000000006f\n[   32.988916] RDX: 0000000000000067 RSI: ffff956983c760e8 RDI: 00000000000001c8\n[   32.989356] RBP: ffffba15c06a7c38 R08: 0000000000000064 R09: 00000000ffffff7f\n[   32.989994] R10: 0000000000000007 R11: ffff956983c760e8 R12: ffff95698225e000\n[   32.990415] R13: 0000000000000000 R14: ffffba15c06a7cd8 R15: ffff95698225e170\n[   32.991011] FS:  \n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fs/ntfs3: Add overflow check for attribute size","id":"CVE-2022-50841","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"drm/virtio: Check whether transferred 2D BO is shmem","id":"CVE-2022-50842"},"packages":[],"prev":{"headline":"scsi: snic: Fix possible UAF in snic_tgt_create()","id":"CVE-2022-50840"},"products":["Linux"],"published":"2025-12-30","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"An integer overflow in the Linux kernel NTFS3 driver allows out-of-bounds memory access, potentially leading to code execution or system crashes.","url":"https://insights.sbomify.com/CVE-2022-50841/"}